iT邦幫忙

第 12 屆 iThome 鐵人賽

DAY 11
0
Security

點錯遊戲的我也只好硬著頭皮上了 系列 第 11

[基本技巧] 惡趣味

  • 分享至 

  • xImage
  •  

「The power room. Have you unlocked it yet?」
「Not yet, but I’m close. It’s unlocking as I solve problems, so keep them coming. I’m on to something.」
「More than something. I’ve talked to my team, and we think it’s the key. 」
「The source code.」
「You mean...」
「You were one of the first to be trapped. We think you are the very first. We think you were instructed to maintain the code to generate that virus.」
「Which means… It’s still in here. in that room, and I can disable it. 」
「For everyone?」
「Possibly. We’ll know for certain when you get in. We’ve been crawling the Nameless servers we have access to, looking for more flags. I’ve already sent a batch of problems your way. With luck, this will be enough to get you to that room and out.」
「Then bring it.」
「I should warn you, before you get out. I have been withholding some… pertinent information from you.」
「Yeah, I’m aware.」
「I think you’re almost ready to hear it. I’ll tell you everything when we next speak, I promise.」


13. music

I wrote you a song. Put it in the picoCTF{} flag format
我寫了一首歌給你,請將他改為 picoCTF{} 的格式。
https://ithelp.ithome.com.tw/upload/images/20200925/20103688MYn31rAYYx.png

HINT:

Do you think you can master rockstar?

WRITEUP:

音樂題真的是死穴,即使看了提示依然沒有頭緒,直接放棄!偷偷google答案(使用題目加上writeup 關鍵字)以後發現提示的 rockstar 是一種惡搞的程式語言,自行定義程式後就可以進行編碼了。

連上 rockstar 的線上網站,並將lyric.txt 內文貼到第一格內,按下output 即可求出編碼後的答案
https://ithelp.ithome.com.tw/upload/images/20200925/20103688M1WQ8iyZtX.png

解譯出來的 output 都是單一個數字,連上轉換編碼網站,嘗試幾種轉碼可發現 10 進位可求出解答。
https://ithelp.ithome.com.tw/upload/images/20200925/20103688K0GTav2PQl.png

這種隱藏式的編碼還蠻出現在現實中的謎題,算是一種宅宅的惡趣味吧 XD

ANSWER:

picoCTF{rrrocknrn0113r}


14. 1_wanna_b3_a_r0ck5tar

I wrote you another song. Put the flag in the picoCTF{} flag format
我又寫了一首歌給你,也試著把他轉為 picoCTF{} 的格式吧。

https://ithelp.ithome.com.tw/upload/images/20200925/201036881HmVPb0Kwo.png

WRITEUP:

與上題類似,放入rockstart 網頁解碼卻發現沒有 output 任何東西。回頭看上題與本題的共同點,很明顯歌詞帶有類型判斷的條件(if … is ),因此可推測是input 的部份要輸入特定的值來讓程式跑下去。

另外查看網站上所提供的範例的話可以發現一些規則,例如 Listen 表示要輸入值來指定給變數,而 is xxx 則是將變數指定為 xxx 長度的數值,所以開頭的 A guitar 就是 10(six-string 有10個字元),因此將 input 輸入10 後會出現 output

A guitar is a six-string
Tommy's been down
Music is a billboard-burning razzmatazz!
Listen to the music
If the music is a guitar
Say "Keep on rocking!"


Output
Keep on rocking!

接下來是要讓第二段的判斷式成立。without 是相減的意思,nothing 可能代表 7 或是 0,這裡測試的結果為後者,因此 input 第二行要輸入 170 (Music = 170)。

Listen to the rhythm
If the rhythm without Music is nothing
Output:
Keep on rocking!
66
79
78
74
79
86
73

最後將這些 10 進位的值丟上轉換器即可求得解答 。

如果了解歌詞本身是判斷式的話,有很多方法可以解出這類題目。例如其中一種做法是將等式直接代換成恆等式。

If music is music
Say "Keep on rocking!"
Listen to the rhythm
If 1

ANSWER:

picoCTF{BONJOVI}


Story 12
「Please understand, for your safety, I could not tell you everything at once」
「Did something happen… outside? While I’m in here?」]()
「Not quite. But you’ll find out very soon, so」
「Yeah?」]()
「Hey. You there?」]()
「Sorry, something’s come up. There’s been a change of plans. Don’t access the power room.」
「Oh. Okay.」
「And you need to go to sleep.」
「What?」
「Go to sleep.」
「Are you sure? You’ve been insisting I stay awake since we met.」
「Go to sleep, Sky. Trust me.」
「I don’t think so. You said you were going through their files. To send me problems.」
「Go to sleep.」
「They got you, didn’t they?」
「Go to sleep.」
「GO TO SLEEP.」


上一篇
[基本技巧] bug - 程式的可能漏洞
下一篇
[網頁漏洞] 瀏覽器內建的強大除錯工具
系列文
點錯遊戲的我也只好硬著頭皮上了 30
圖片
  直播研討會
圖片
{{ item.channelVendor }} {{ item.webinarstarted }} |
{{ formatDate(item.duration) }}
直播中

尚未有邦友留言

立即登入留言